-----------------------------------------------------------------------------

   THIS HELP READER WAS WRITTEN BY JORIS RLING AND SUBSEQUENTLY BORROWED!

-----------------------------------------------------------------------------

    Interferon, v2.08 (10 Nov 1991, 1504 bytes) -  1991 Tor O. Houghton

Introduction:

    Interferon is a medical term for a protein substance which prevents
    the development of a virus in living cells. Consider your magnetic
    media as living cells. Weird, ok. But nevertheless, if a virus first
    manages to infect one file on it, you can be sure that in time, all
    files will be infected (depending on the virus, of course). By files,
    I mean files which can be executed, of the type Obey, Absolute,
    Utility, and also files which do not have any type, but merely a
    load and execution address.
    
    To be able to infect a file, bytes have to be written to it. This 
    is usually done from special areas in memory - that is, if the
    virus is a module. Most viruses these days lie dormant in the RMA 
    and wait for a certain type of action to take place before it infects
    a file.

What Interferon does:

    To put it simple, it watches what the Archimedes tries to do, and if
    it detects a save from these areas, Interferon intercepts the call
    and gives a suitable message to the user (you). You should then take
    neccesary action to check if there really is a virus in memory.

    Please do get suspicious if a message pops up while you are trying to
    start an application, or if you just opened a directory with a lot
    of applications in it.

    PLEASE READ THE INFORMATION ABOUT THE CURRENT VERSIONS (SEE BELOW).

Current viruses which Interferon kills (in memory only):

    NetStatus - named so because it installs itself ontop of the original
                Acorn module. Disassembly shows that all it does is copy
                itself from time to time. When a certain time has elapsed
                it writes a message in the middle of the screen and goes
                back to sleep.
                
                This virus infects the boot file, adding a 2073 long
                module to it. 

Messages which Interferon gives:

    1) WARNING: Interferon detected and intercepted a save from an area 
                defined as illegal. Clicking 'CANCEL' will save it as 
                '$.FAILED'.
                               
    If an attempt to save from the RMA or below &8000 is about to occur,
    Interferon detects this and instead gives you the choice of either
    letting it happen (clicking 'OK'), or intercepts the call and makes
    the originator (a possible virus) save the file as '$.FAILED', so
    that you may have a look at what was saved. To see how this works,
    simply try to save the palette.

    2) WARNING: For some reason Interferon failed to create the mentioned 
                file. However, the save was fully intercepted and negated.
                                               
    This message might pop up if you already have a file with such a name
    and if it is locked (if the originator tried a GBPB action).

    3) WARNING: A suspicious module by the name of NetStatus has been 
                found and killed. One or more of your !Boot files might be 
                infected.

    This means that you've probably been infected by the NetStatus virus.
    What interferon does, is look up the module's start address, and if 
    the word found at offset 1020 is "LOAD" (part of LOAD <Obey$Dir>.!Boot),
    then this will trigger Interferon to try and kill it. If successful, 
    the message above will be displayed.

    4) WARNING: Interferon has been called through its finalisation code
                and will be killed. Click 'CANCEL' to invoke a hard reset.

    If a program tried to kill Interferon (also happens if you load the
    module while it already is resident in memory), this message will 
    appear. Clicking 'OK' will kill Interferon, but 'CANCEL' will reset 
    the machine and clear the memory.

Notes:
               
    All non-Econet users are advised to *UNPLUG* all Net modules, as it 
    seems that these are the prime target for viruswriters these days.
    By doing this, you can easily spot a new version, as it will have a 
    different position (its address will be 018xxxxx) if *RMLoaded, and
    if created from memory (NetStatus performs an SWI OS_Module) it will
    be placed at the end of the module list.

    Interferon only tries to detect a certain type of virus. This means 
    that viruses written in BASIC and/or are set up as (nameless) tasks
    will not be detected as these usually save themselves from an area
    which Interferon does not check for. My suggestion is then to get
    hold of "VKiller" (last version to my knowledge is 2.30), by
    Richard K. Lloyd. This should kill most task viruses. In fact, I
    think that, having these two programs (always updated), you should be
    fairly safe from infection.

    Also: Extensive swapping of software contributes to the spreading of
    viruses.
    
    You are strongly advised to include the Interferon module in your
    !System folder if you have a harddisc and include it in your startup
    sequence (needless to say, this should be the first module loaded).
    
Version history:

    1.05 - The first release version (actually 1.05c).
    1.06 - Second version to hit the public. Minor changes, but no bug
           corrections. 
    1.07 - More changes. Is not compatible with Terje 
           'VirusKill' as he uses memory areas illegal to Interferon.
    1.10 - Interferon will allow saves of less than 256 bytes, but will
           pop up with a request window, asking for confirmation. I.e.
           Interferon is now compatible with the palette utility.
    2.00 - An all new handling of saving from the areas defined as 
           illegal. Now asks the user for confirmation, and if the user
           doesn't wish the save to take place, Interferon saves the file
           as '$.FAILED'. The user may then look at what actually was
           saved from the 'illegal' areas. If a user knows what's
           happening, there is now no problem to click 'OK' to allow the
           action to proceed. (Which makes it compatible with Terje 
           Sletteb's 'VirusKill').
    2.01 - Bugfix: Didn't work too well with PlaceIt. Fixed now, and 
           thanks to Ola Presterud for letting me know!
    2.05 - Fixed 'Press space or mouse to continue' prompt when starting
           the module from a non-wimp environment. It now merely displays
           the name of the module along with the version. ("Interferon: 
           v2.05 installed.") Also added code to prevent suspicious 
           programs from killing Interferon. If something like this 
           happens while in the wimp environment, you are given the
           choice of clicking 'CANCEL' to do a hard-reset, or 'OK' to 
           kill Interferon. If you are in a non-wimp environment, you may
           still reset the machine while the 'Press space or click mouse
           to continue' prompt is active (hit CTRL+BREAK!), as all current
           operations are held at this point.
    2.06 - Added 'close all open files' code before reset. I used to have
           a Lingenuity interface once (take note!! ONCE), and remembered
           that open files could cause disk errors. Now I use Morley!
    2.08 - Fixed bug with *SCREENSAVE. Apparently *SCREENSAVE gets its
           palette data from zero page! Weird?? Anyway - thanks to Claus
           Nickelsen for pointing this out!

Final note:

    This piece of code is copyright, and should not be distributed 
    without this !ReadMe file. It is public domain, and as such, there
    are certain rules to follow, i.e. don't distribute it for profit
    etc. etc. 

    I would be most happy to receive a disc or two from any public 
    domain library which distributes this! :-)

My address is as follows:

    Tor O. Houghton
    Fjellveien 4
    PO Box 142
    1362 Billingstad
    NORWAY        

    Tel: +47-(0)2-847569
    Fax: +47-(0)2-848287

    email: bhotvedt@gollum.uio.no (write 'For Tor Houghton' or something
           like that in the subject or message area).
    
    The World of Cryton: #121, +44 (0)749 679794/670030 / 300-14400bps

    Excelsior! (M)BBS: +47 (0)2 846379 (CoSysOp!) / 300-14400bps


A message to Mr. Joris Rling:

    I hope you don't mind me borrowing this text reader (it's wonderful!).